Secure cloud accounts and storage
Short label: CLOUD
Meaning
Control who can access cloud services, which files are public and how systems can be recovered.
Why it matters
A mistaken permission or an account with excessive access can expose business information.
What you can do
Inventory services and administrators. Check permissions, sign-in protection, backups and the provider’s access arrangements.
Services that can help
Sovereign Storage, Private AI and Custom Software can support the chosen design. We document the hosting and administration relevant to each service.
Official reference — NIS2 Art. 21(2)(d)
2. The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following:
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)
(d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;
— Directive (EU) 2022/2555 (NIS2), Art. 21(2)(d)
Your suppliers and service providers are part of your security: you must know what they do for you and what you require of them.
Read the article on EUR-Lex → · Official text, quoted from the Official Journal of the EU
Acronyms used here: NIS2, GDPR, DORA, CRA
- NIS2 — Network and Information Systems Directive 2
- An EU cybersecurity directive with requirements for organisations covered by its scope.
- GDPR — General Data Protection Regulation
- The EU regulation on personal-data protection. RGPD is the French name and AVG the Dutch name.
- DORA — Digital Operational Resilience Act
- EU rules on digital operational resilience in the financial sector.
- CRA — Cyber Resilience Act
- EU cybersecurity rules for products with digital elements, including certain software and connected devices.